<%# The license inside this block applies to this file.
	# Copyright 2017 Google Inc.
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	#     http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.
-%>
// The BackendService API's Update / PUT API is badly formed and behaves like
// a PATCH field for at least IAP. When sent a `null` `iap` field, the API
// doesn't disable an existing field. To work around this, we need to emulate
// the old Terraform behaviour of always sending the block (at both update and
// create), and force sending each subfield as empty when the block isn't
// present in config.

iapVal := obj["iap"]
if iapVal == nil {
	data := map[string]interface{}{}
	data["enabled"] = false
	data["oauth2ClientId"] = ""
	data["oauth2ClientSecret"] = ""
	obj["iap"] = data
} else {
	iap := iapVal.(map[string]interface{})
	iap["enabled"] = true
	obj["iap"] = iap
}

backendsRaw, ok := obj["backends"]
if !ok {
	return obj, nil
}
backends := backendsRaw.([]interface{})
for _, backendRaw := range backends {
	backend := backendRaw.(map[string]interface{})

	if isNegBackend(backend) {
		// Remove `max_utilization` from any backend that belongs to an NEG. This field
		// has a default value and causes API validation errors
		backend["maxUtilization"] = nil
	}
}

return obj, nil
